Linux /lostfound and its architecture!


Guide outline

1.1. Overview
1.2. The Root Directory
1.3. /bin
1.4. /boot
1.5. /dev
1.6. /etc
1.7. /home
1.8. /initrd
1.9. /lib
1.10. /lost+found
1.11. /media
1.12. /mnt
1.13. /opt
1.14. /proc
1.15. /root
1.16. /sbin
1.17. /usr
1.18. /var
1.19. /srv
1.20. /tm
2. Glossary

Additional Linux Resources

Here is a list of resources for learning Linux:

Resources for System Administrators

Linux System Admin Guide- What is Linux Operating System and how it works
Linux System Admin Guide- What are Directory Tree and Filesystem Hierarchy in Linux
Linux System Admin Guide- Introduction to Linux File Systems for System Admins
Linux System Admin Guide- Overview of Linux Virtual Memory and Disk Buffer Cache
Linux System Admin Guide- Best Practices for Monitoring Linux Systems
Linux System Admin Guide- Best Practices for Performing Linux Boots and Shutdowns
Linux System Admin Guide- Best Practices for Making and Managing Backup Operations

Resources for Linux Kernel Programmers

How Linux Operating System Memory Management works
Comprehensive Review of Linux Kernel Operating System Processes
Comprehensive Review of Linux File System Architecture and Management
What are mechanisms behind Linux Kernel task management
How Linux Kernel Sources and Functions work
Comprehensive look at how Linux Data Structures work

Hands-on Linux classes

Linux Operating System Distributions

Comprehensive list of all Linux OS distributions
Comprehensive list of all special purpose Linux distributions
Comprehensive list of all secure Linux distributions for cybersecurity professionals

One-to-One Live Linux Classes

Coding Bootcamps school offers One-to-One Live Linux Classes for Beginners.

 

1.10. /lost+found

As was explained earlier during the overview of the FSSTND, Linux should always go through a proper shutdown. Sometimes your system might crash or a power failure might take the machine down. Either way, at the next boot, a lengthy filesystem check (the speed of this check is dependent on the type of filesystem that you actually use. ie. ext3 is faster than ext2 because it is a journalled filesystem) using fsck will be done. Fsck will go through the system and try to recover any corrupt files that it finds. The result of this recovery operation will be placed in this directory. The files recovered are not likely to be complete or make much sense but there always is a chance that something worthwhile is recovered. Each partition has its own lost+found directory. If you find files in there, try to move them back to their original location. If you find something like a broken symbolic link to ‘file’, you have to reinstall the file/s from the corresponding RPM, since your file system got damaged so badly that the files were mutilated beyond recognition. Below is an example of a /lost+found directory. As you can see, the vast majority of files contained here are in actual fact sockets. As for the rest of the other files they were found to be damaged system files and personal files. These files were not able to be recovered.

 

      total 368
      -rw-r--r-- 1 root root 110891 Oct 5 14:14 #388200
      -rw-r--r-- 1 root root 215 Oct 5 14:14 #388201
      -rw-r--r-- 1 root root 110303 Oct 6 23:09 #388813
      -rw-r--r-- 1 root root 141 Oct 6 23:09 #388814
      -rw-r--r-- 1 root root 110604 Oct 6 23:09 #388815a
      -rw-r--r-- 1 root root 194 Oct 6 23:09 #388816
      srwxr-xr-x 1 root root 0 Oct 6 13:00 #51430
      srwxr-xr-x 1 root root 0 Oct 6 00:23 #51433
      -rw------- 1 root root 63 Oct 6 00:23 #51434
      srwxr-xr-x 1 root root 0 Oct 6 13:00 #51436
      srwxrwxrwx 1 root root 0 Oct 6 00:23 #51437
      srwx------ 1 root root 0 Oct 6 00:23 #51438
      -rw------- 1 root root 63 Oct 6 13:00 #51439
      srwxrwxrwx 1 root root 0 Oct 6 13:00 #51440
      srwx------ 1 root root 0 Oct 6 13:00 #51442
      -rw------- 1 root root 63 Oct 6 23:09 #51443
      srwx------ 1 root root 0 Oct 6 10:40 #51445
      srwxrwxrwx 1 root root 0 Oct 6 23:09 #51446
      srwx------ 1 root root 0 Oct 6 23:09 #51448